CVE-2026-46163

wifi: b43legacy: enforce bounds check on firmware key index in RX path

State: Published
Severity: Not scored
Published: May 28, 2026
Updated: Oct 15, 2026
Reserved: May 13, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

wifi: b43legacy: enforce bounds check on firmware key index in RX path

Same fix as b43: the firmware-controlled key index in b43legacy_rx() can exceed dev->max_nr_keys. The existing B43legacy_WARN_ON is non-enforcing in production builds, allowing an out-of-bounds read of dev->key[].

Make the check enforcing by dropping the frame for invalid indices.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	75388acd0cd827dc1498043daa7d1c760902cd67 to before a92bd0503df2488f2cc040f329ebccff1c1934cbAffected 75388acd0cd827dc1498043daa7d1c760902cd67 to before df805c1d085b7a96077f0964185764c87060950dAffected 75388acd0cd827dc1498043daa7d1c760902cd67 to before 4242db36de99de734cc1f60e5edd86cda7e598c6Affected 75388acd0cd827dc1498043daa7d1c760902cd67 to before 1baaeb6adecb9691748c0253dab6ddd19a2b4e9eAffected 75388acd0cd827dc1498043daa7d1c760902cd67 to before 6ee946077607d7783ae6709a899213fc4fe08f35Affected 75388acd0cd827dc1498043daa7d1c760902cd67 to before 9d1bc155802943e92c57a5fb923d23edfbf0b525Affected 75388acd0cd827dc1498043daa7d1c760902cd67 to before fdd4e51979f42ca8b1ab7e6176b607e1caabf2a5Affected 75388acd0cd827dc1498043daa7d1c760902cd67 to before a035766f970bde2d4298346a31a80685be5c0205Affected
LinuxLinux	2.6.24Affected before 2.6.24Not affected 5.10.258 through 5.10.Not affected 5.15.209 through 5.15.Not affected 6.1.175 through 6.1.Not affected 6.6.140 through 6.6.Not affected 6.12.88 through 6.12.Not affected 6.18.30 through 6.18.Not affected 7.0.7 through 7.0.*Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

75388acd0cd827dc1498043daa7d1c760902cd67 to before a92bd0503df2488f2cc040f329ebccff1c1934cbAffected
75388acd0cd827dc1498043daa7d1c760902cd67 to before df805c1d085b7a96077f0964185764c87060950dAffected
75388acd0cd827dc1498043daa7d1c760902cd67 to before 4242db36de99de734cc1f60e5edd86cda7e598c6Affected
75388acd0cd827dc1498043daa7d1c760902cd67 to before 1baaeb6adecb9691748c0253dab6ddd19a2b4e9eAffected
75388acd0cd827dc1498043daa7d1c760902cd67 to before 6ee946077607d7783ae6709a899213fc4fe08f35Affected
75388acd0cd827dc1498043daa7d1c760902cd67 to before 9d1bc155802943e92c57a5fb923d23edfbf0b525Affected
75388acd0cd827dc1498043daa7d1c760902cd67 to before fdd4e51979f42ca8b1ab7e6176b607e1caabf2a5Affected
75388acd0cd827dc1498043daa7d1c760902cd67 to before a035766f970bde2d4298346a31a80685be5c0205Affected

LinuxLinux

2.6.24Affected
before 2.6.24Not affected
5.10.258 through 5.10.*Not affected
5.15.209 through 5.15.*Not affected
6.1.175 through 6.1.*Not affected
6.6.140 through 6.6.*Not affected
6.12.88 through 6.12.*Not affected
6.18.30 through 6.18.*Not affected
7.0.7 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.